PT-2021-11047 · D Link · D-Link Dsl-2888A

Harold Zang · Published 2021-01-08 · Updated 2021-04-23 · CVE-2020-24577

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2888A versions prior to AU 2.31 V1.1.47ae55

Description: An issue was discovered where the One Touch application discloses sensitive information. This includes the hashed admin login password and the Internet provider connection username and cleartext password. The sensitive information is disclosed in the application's response body for a "/tmp/var/passwd" or "/tmp/home/wan stat" URI.

Recommendations: For versions prior to AU 2.31 V1.1.47ae55, update the firmware to AU 2.31 V1.1.47ae55 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/tmp/var/passwd" and "/tmp/home/wan stat" URIs until a patch is available. Avoid using the One Touch application until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-24577

Affected Products

D-Link Dsl-2888A

References · 7

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241 · Exploit
• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce · Exploit
• https://osv.dev/vulnerability/CVE-2020-24577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24577 · Security Note
• https://t.me/cvenotify/8476 · Telegram Post
• https://t.me/cvenotify/8318 · Telegram Post
• https://trustwave.com/en-us/resources/security-resources/security-advisories · Note